Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Race conditions on Facebook, DigitalOcean and others (fixed)

josipfranjkovic.blogspot.com

Post reply on HN
Print view View original

11–20 of 90 posts

Re: Race conditions on Facebook, DigitalOcean and others (fixed)

#11

Post by franjkovic »

mwsherman wrote: post #10
franjkovic wrote: post #7

Earlier quoted context omitted.

The bounty actually surprised me, too. I expected between $1000-$2000. That is one of reasons I like reporting bugs to Facebook - they pay really good, critical bugs are fixed really fast ( One time they paid me $5000 for a bug I never could have found, but they did internally based on my low severity report. ( http://josipfranjkovic.blogspot.com/2013/11/facebook-bug-bou... )

It’s impressive that they are able to fix them so quickly – one needs to imagine they get a non-trivial number of reports, and that some majority of them are junk. They have a good triage + repro + escalation system.

Facebook puts out stats from their bug bounty program once a year. Most of bugs are invalid reports - in 2013 they had 14,763 reports, with 687 being valid.

(https://www.fb.com/818902394790655)

They probably got a couple people working exclusively on bug bounty reports. I also have to say they did a great job changing communication channels from emails to tickets which show in /support/, it is way easier now. The downside is that you must have a Facebook account, not sure if it was needed before the change.

Re: Race conditions on Facebook, DigitalOcean and others (fixed)

#12

Post by monksy »

ejcx wrote: post #8

I actually fixed the issue that was reported to LastPass. I could be mistaken but I believe he reported the security issue through our regular support channel which is why it took three days to see (instead of our security channel). From the time I saw it, I fixed it with the patch going live within an hour or two. When I DID see it, tried it myself with a quick shell script that that curled and backgrounded the same…

BTW: I just subscribed to LastPass a few days ago. I'm pretty happy with the service.

Re: Race conditions on Facebook, DigitalOcean and others (fixed)

#13

Post by franjkovic »

ejcx wrote: post #8

I actually fixed the issue that was reported to LastPass. I could be mistaken but I believe he reported the security issue through our regular support channel which is why it took three days to see (instead of our security channel). From the time I saw it, I fixed it with the patch going live within an hour or two. When I DID see it, tried it myself with a quick shell script that that curled and backgrounded the same…

Thanks! I reported the bug to security@ email, and one of your team's members replied on the same day (January 6th). Either way, good job on fixing this really fast. I wish more teams are as responsive as yours.

Re: Race conditions on Facebook, DigitalOcean and others (fixed)

#15

Post by underwater »

andersonmvd wrote: post #4

More interesting than the bounty itself is to understand which defense works best at scale and the nitty gritty details of those kind of attacks. Intuitively I think that we just need to avoid inconsistencies between the Time of Check (TOC) and Time of Use (TOU), so veryfing the existence of a discount coupon while inserting it in one query should do the trick (INSERT INTO coupons (...) Values (...) WHERE NOT EXISTS…

Not every database is powered by SQL. Add to that sharding, caching, cross data center traffic and the problem becomes non trivial very quickly.

Re: Race conditions on Facebook, DigitalOcean and others (fixed)

#16

Post by Osiris »

andersonmvd wrote: post #4

More interesting than the bounty itself is to understand which defense works best at scale and the nitty gritty details of those kind of attacks. Intuitively I think that we just need to avoid inconsistencies between the Time of Check (TOC) and Time of Use (TOU), so veryfing the existence of a discount coupon while inserting it in one query should do the trick (INSERT INTO coupons (...) Values (...) WHERE NOT EXISTS…

This could be an issue of a clustered database where the requests are being load balanced to multiple masters and due to latency in replication, part of the cluster may not be consistent with the other part yet. Though for someone like DigitalOcean I'd be surprised if this was the case.

Re: Race conditions on Facebook, DigitalOcean and others (fixed)

#17

Post by ejcx »

franjkovic wrote: post #13
ejcx wrote: post #8

I actually fixed the issue that was reported to LastPass. I could be mistaken but I believe he reported the security issue through our regular support channel which is why it took three days to see (instead of our security channel). From the time I saw it, I fixed it with the patch going live within an hour or two. When I DID see it, tried it myself with a quick shell script that that curled and backgrounded the same…

Thanks! I reported the bug to security@ email, and one of your team's members replied on the same day (January 6th). Either way, good job on fixing this really fast. I wish more teams are as responsive as yours.

Oh okay I was mistaken then.

I believe the race condition is on the rise in terms of severity and importance. Developers are aware of common OWASP bugs, but this type of race condition is often overlooked and developers are going to NEED to be just as aware of. Way to go.

Post reply on HN